CVE-2026-111762
Received Received - Intake

A2A Java SDK Logs Sensitive Data in Cleartext

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSON request body at SEVERE level when JsonFormat.parser().merge() throws InvalidProtocolBufferException. With push notifications enabled, createTaskPushNotificationConfiguration reaches this parser for requests to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs`, whose token and authentication.credentials fields can contain bearer tokens and authentication credentials for client push endpoints. A valid JSON body that fails protobuf deserialization, including an unknown field under strict parsing or a schema mismatch, causes those secrets to be written to the server logs in cleartext. An attacker with access to the server logs or a log aggregation system can retrieve the credentials and potentially use the credentials to send forged task status updates to the client's push notification endpoint. This issue is fixed in version 1.3.0.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-111762
EUVD
EUVD-2026-105044

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
a2aproject a2a-java < 1.3.0.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the A2A Java SDK (versions before 1.3.0.Final) involves logging sensitive data in server logs when JSON request bodies fail protobuf deserialization. The RestHandler.parseRequestBody method logs the entire request body at SEVERE level when JsonFormat.parser().merge() throws InvalidProtocolBufferException. This exposes fields like bearer tokens and authentication credentials in cleartext, which can be accessed by attackers with log access.

Detection Guidance

Check server logs for entries containing 'SEVERE' level messages from RestHandler.parseRequestBody that log full JSON request bodies. Look for logs showing 'token' or 'authentication.credentials' fields in cleartext during parsing errors.

Impact Analysis

If you use the affected A2A Java SDK versions (before 1.3.0.Final) with push notifications enabled, an attacker with access to server logs or log aggregation systems could retrieve exposed credentials. This could allow them to authenticate to your push notification endpoints and send forged task status updates, potentially compromising system integrity or client applications.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR (data protection) and HIPAA (healthcare data) due to the exposure of sensitive authentication credentials in logs. Logging such data constitutes a breach of confidentiality obligations, potentially leading to regulatory penalties, fines, or mandatory breach notifications depending on jurisdiction and affected data scope.

Mitigation Strategies
  • Upgrade to A2A Java SDK version 1.3.0.Final or later to apply the fix that prevents logging sensitive data in request bodies.
  • Review and sanitize existing server logs to remove any previously logged credentials or tokens from parsing errors.
  • Monitor logs for any unauthorized access attempts to push notification endpoints using retrieved credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart